<!doctype html>
<html lang="en-GB">
<head>
	<meta charset="UTF-8" />
	<meta name="viewport" content="width=device-width, initial-scale=1" />
	<link rel="profile" href="https://gmpg.org/xfn/11" />
	<title>Analysis of the &#8220;lib__mdma.so.1&#8221; userland rootkit &#8211; Darren Martyn</title>
<meta name='robots' content='max-image-preview:large' />

<!-- Async WordPress.com Remote Login -->
<script id="wpcom_remote_login_js">
var wpcom_remote_login_extra_auth = '';
function wpcom_remote_login_remove_dom_node_id( element_id ) {
	var dom_node = document.getElementById( element_id );
	if ( dom_node ) { dom_node.parentNode.removeChild( dom_node ); }
}
function wpcom_remote_login_remove_dom_node_classes( class_name ) {
	var dom_nodes = document.querySelectorAll( '.' + class_name );
	for ( var i = 0; i < dom_nodes.length; i++ ) {
		dom_nodes[ i ].parentNode.removeChild( dom_nodes[ i ] );
	}
}
function wpcom_remote_login_final_cleanup() {
	wpcom_remote_login_remove_dom_node_classes( "wpcom_remote_login_msg" );
	wpcom_remote_login_remove_dom_node_id( "wpcom_remote_login_key" );
	wpcom_remote_login_remove_dom_node_id( "wpcom_remote_login_validate" );
	wpcom_remote_login_remove_dom_node_id( "wpcom_remote_login_js" );
	wpcom_remote_login_remove_dom_node_id( "wpcom_request_access_iframe" );
	wpcom_remote_login_remove_dom_node_id( "wpcom_request_access_styles" );
}

// Watch for messages back from the remote login
window.addEventListener( "message", function( e ) {
	if ( e.origin === "https://r-login.wordpress.com" ) {
		var data = {};
		try {
			data = JSON.parse( e.data );
		} catch( e ) {
			wpcom_remote_login_final_cleanup();
			return;
		}

		if ( data.msg === 'LOGIN' ) {
			// Clean up the login check iframe
			wpcom_remote_login_remove_dom_node_id( "wpcom_remote_login_key" );

			var id_regex = new RegExp( /^[0-9]+$/ );
			var token_regex = new RegExp( /^.*|.*|.*$/ );
			if (
				token_regex.test( data.token )
				&& id_regex.test( data.wpcomid )
			) {
				// We have everything we need to ask for a login
				var script = document.createElement( "script" );
				script.setAttribute( "id", "wpcom_remote_login_validate" );
				script.src = '/remote-login.php?wpcom_remote_login=validate'
					+ '&wpcomid=' + data.wpcomid
					+ '&token=' + encodeURIComponent( data.token )
					+ '&host=' + window.location.protocol
					+ '//' + window.location.hostname
					+ '&postid=491'
					+ '&is_singular=1';
				document.body.appendChild( script );
			}

			return;
		}

		// Safari ITP, not logged in, so redirect
		if ( data.msg === 'LOGIN-REDIRECT' ) {
			window.location = 'https://wordpress.com/log-in?redirect_to=' + window.location.href;
			return;
		}

		// Safari ITP, storage access failed, remove the request
		if ( data.msg === 'LOGIN-REMOVE' ) {
			var css_zap = 'html { -webkit-transition: margin-top 1s; transition: margin-top 1s; } /* 9001 */ html { margin-top: 0 !important; } * html body { margin-top: 0 !important; } @media screen and ( max-width: 782px ) { html { margin-top: 0 !important; } * html body { margin-top: 0 !important; } }';
			var style_zap = document.createElement( 'style' );
			style_zap.type = 'text/css';
			style_zap.appendChild( document.createTextNode( css_zap ) );
			document.body.appendChild( style_zap );

			var e = document.getElementById( 'wpcom_request_access_iframe' );
			e.parentNode.removeChild( e );

			document.cookie = 'wordpress_com_login_access=denied; path=/; max-age=31536000';

			return;
		}

		// Safari ITP
		if ( data.msg === 'REQUEST_ACCESS' ) {
			console.log( 'request access: safari' );

			// Check ITP iframe enable/disable knob
			if ( wpcom_remote_login_extra_auth !== 'safari_itp_iframe' ) {
				return;
			}

			// If we are in a "private window" there is no ITP.
			var private_window = false;
			try {
				var opendb = window.openDatabase( null, null, null, null );
			} catch( e ) {
				private_window = true;
			}

			if ( private_window ) {
				console.log( 'private window' );
				return;
			}

			var iframe = document.createElement( 'iframe' );
			iframe.id = 'wpcom_request_access_iframe';
			iframe.setAttribute( 'scrolling', 'no' );
			iframe.setAttribute( 'sandbox', 'allow-storage-access-by-user-activation allow-scripts allow-same-origin allow-top-navigation-by-user-activation' );
			iframe.src = 'https://r-login.wordpress.com/remote-login.php?wpcom_remote_login=request_access&origin=' + encodeURIComponent( data.origin ) + '&wpcomid=' + encodeURIComponent( data.wpcomid );

			var css = 'html { -webkit-transition: margin-top 1s; transition: margin-top 1s; } /* 9001 */ html { margin-top: 46px !important; } * html body { margin-top: 46px !important; } @media screen and ( max-width: 660px ) { html { margin-top: 71px !important; } * html body { margin-top: 71px !important; } #wpcom_request_access_iframe { display: block; height: 71px !important; } } #wpcom_request_access_iframe { border: 0px; height: 46px; position: fixed; top: 0; left: 0; width: 100%; min-width: 100%; z-index: 99999; background: #23282d; } ';

			var style = document.createElement( 'style' );
			style.type = 'text/css';
			style.id = 'wpcom_request_access_styles';
			style.appendChild( document.createTextNode( css ) );
			document.body.appendChild( style );

			document.body.appendChild( iframe );
		}

		if ( data.msg === 'DONE' ) {
			wpcom_remote_login_final_cleanup();
		}
	}
}, false );

// Inject the remote login iframe after the page has had a chance to load
// more critical resources
window.addEventListener( "DOMContentLoaded", function( e ) {
	var iframe = document.createElement( "iframe" );
	iframe.style.display = "none";
	iframe.setAttribute( "scrolling", "no" );
	iframe.setAttribute( "id", "wpcom_remote_login_key" );
	iframe.src = "https://r-login.wordpress.com/remote-login.php"
		+ "?wpcom_remote_login=key"
		+ "&origin=aHR0cHM6Ly9kYXJyZW5tYXJ0eW4uaWU%3D"
		+ "&wpcomid=171792927"
		+ "&time=1640306141";
	document.body.appendChild( iframe );
}, false );
</script>
<link rel='dns-prefetch' href='//s2.wp.com' />
<link rel='dns-prefetch' href='//s0.wp.com' />
<link rel='dns-prefetch' href='//darrenmartynie.wordpress.com' />
<link rel='dns-prefetch' href='//wordpress.com' />
<link rel="alternate" type="application/rss+xml" title="Darren Martyn &raquo; Feed" href="https://darrenmartyn.ie/feed/" />
<link rel="alternate" type="application/rss+xml" title="Darren Martyn &raquo; Comments Feed" href="https://darrenmartyn.ie/comments/feed/" />
<link rel="alternate" type="application/rss+xml" title="Darren Martyn &raquo; Analysis of the &#8220;lib__mdma.so.1&#8221; userland&nbsp;rootkit Comments Feed" href="https://darrenmartyn.ie/2021/11/29/analysis-of-the-lib__mdma-so-1-userland-rootkit/feed/" />
	<script type="text/javascript">
		/* <![CDATA[ */
		function addLoadEvent(func) {
			var oldonload = window.onload;
			if (typeof window.onload != 'function') {
				window.onload = func;
			} else {
				window.onload = function () {
					oldonload();
					func();
				}
			}
		}
		/* ]]> */
	</script>
			<script>
			window._wpemojiSettings = {"baseUrl":"https:\/\/s0.wp.com\/wp-content\/mu-plugins\/wpcom-smileys\/twemoji\/2\/72x72\/","ext":".png","svgUrl":"https:\/\/s0.wp.com\/wp-content\/mu-plugins\/wpcom-smileys\/twemoji\/2\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/s2.wp.com\/wp-includes\/js\/wp-emoji-release.min.js?m=1625065786h&ver=5.8.2"}};
			!function(e,a,t){var n,r,o,i=a.createElement("canvas"),p=i.getContext&&i.getContext("2d");function s(e,t){var a=String.fromCharCode;p.clearRect(0,0,i.width,i.height),p.fillText(a.apply(this,e),0,0);e=i.toDataURL();return p.clearRect(0,0,i.width,i.height),p.fillText(a.apply(this,t),0,0),e===i.toDataURL()}function c(e){var t=a.createElement("script");t.src=e,t.defer=t.type="text/javascript",a.getElementsByTagName("head")[0].appendChild(t)}for(o=Array("flag","emoji"),t.supports={everything:!0,everythingExceptFlag:!0},r=0;r<o.length;r++)t.supports[o[r]]=function(e){if(!p||!p.fillText)return!1;switch(p.textBaseline="top",p.font="600 32px Arial",e){case"flag":return s([127987,65039,8205,9895,65039],[127987,65039,8203,9895,65039])?!1:!s([55356,56826,55356,56819],[55356,56826,8203,55356,56819])&&!s([55356,57332,56128,56423,56128,56418,56128,56421,56128,56430,56128,56423,56128,56447],[55356,57332,8203,56128,56423,8203,56128,56418,8203,56128,56421,8203,56128,56430,8203,56128,56423,8203,56128,56447]);case"emoji":return!s([10084,65039,8205,55357,56613],[10084,65039,8203,55357,56613])}return!1}(o[r]),t.supports.everything=t.supports.everything&&t.supports[o[r]],"flag"!==o[r]&&(t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&t.supports[o[r]]);t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&!t.supports.flag,t.DOMReady=!1,t.readyCallback=function(){t.DOMReady=!0},t.supports.everything||(n=function(){t.readyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(n=t.source||{}).concatemoji?c(n.concatemoji):n.wpemoji&&n.twemoji&&(c(n.twemoji),c(n.wpemoji)))}(window,document,window._wpemojiSettings);
		</script>
		<style>
img.wp-smiley,
img.emoji {
	display: inline !important;
	border: none !important;
	box-shadow: none !important;
	height: 1em !important;
	width: 1em !important;
	margin: 0 .07em !important;
	vertical-align: -0.1em !important;
	background: none !important;
	padding: 0 !important;
}
</style>
	<link rel='stylesheet' id='all-css-0-1' href='https://s1.wp.com/_static/??-eJytks1ugzAQhF+oxgFFiEvVZzH2im7iP3nXQX77AqURpSnpoRdLo91vNGuNHKPQwTN4li6LaPOAnuQYdXCCHFooO1Vpohf5GNMhgeB3cEDT2EXFksdpp3j0wAD+CE5gFYMRMRDv1BFm8QokL8BR6atY1I/1r90hT7KHNIg5qbzVTdVUJ9lntEb2NiwGfVKpSOJi4T+Mlu+4G6HXNps5MEkHBhXYaTxftBHRqgJJWBiULpVD/xyfZlv9Dfo9/JJ083mqhMxiSGj+fP/OIilGP9ATXIcVa6q6q2pB6KIFaZD4PhOPLfZtW2u2v/8A+2xz38cERGJ6HWa3tnbm3txr3Z5Pddee2+7yAT2VLK0=?cssminify=yes' type='text/css' media='all' />
<style id='wp-block-library-inline-css'>
.has-text-align-justify {
	text-align:justify;
}
</style>
<style id='global-styles-inline-css'>
body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--duotone--dark-grayscale: url('#wp-duotone-dark-grayscale');--wp--preset--duotone--grayscale: url('#wp-duotone-grayscale');--wp--preset--duotone--purple-yellow: url('#wp-duotone-purple-yellow');--wp--preset--duotone--blue-red: url('#wp-duotone-blue-red');--wp--preset--duotone--midnight: url('#wp-duotone-midnight');--wp--preset--duotone--magenta-yellow: url('#wp-duotone-magenta-yellow');--wp--preset--duotone--purple-green: url('#wp-duotone-purple-green');--wp--preset--duotone--blue-orange: url('#wp-duotone-blue-orange');--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;}
</style>
<link rel='stylesheet' id='all-css-2-1' href='https://s1.wp.com/_static/??-eJxdjEsKgDAMRC9kDX4QN+JdlKDRJi00Rby9EUHE3cybDxzRzUEURYGziz4vJAnmwGzIedrRXPqR0kgBBBKUbJ1e8QSfT12R7SHmCfQwcAoJKqJA0tPj3R95qLqmr6u+brvtArQDNac=?cssminify=yes' type='text/css' media='all' />
<link rel='stylesheet' id='print-css-3-1' href='https://s2.wp.com/wp-content/themes/pub/twentynineteen/print.css?m=1623341260h&cssminify=yes' type='text/css' media='print' />
<link rel='stylesheet' id='all-css-4-1' href='https://s1.wp.com/_static/??-eJx9i0EOwjAMBD+EsZAIKAfEW9rIBKPEjhpHUX/fcGsvve2sZrAXCCpGYmhfylSxtBmtj2MVFjIiQZaA1dZE0EvQfA21XnBX5gYltchSMZJC0jAZqxwAPmni5SxdaE4ax4w4rB3+o3d+3dzdu6d/OP/bABmSRA8=?cssminify=yes' type='text/css' media='all' />
<style id='jetpack-global-styles-frontend-style-inline-css'>
:root { --font-headings: unset; --font-base: unset; --font-headings-default: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif; --font-base-default: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif;}
</style>
<link rel='stylesheet' id='all-css-6-1' href='https://s1.wp.com/_static/??-eJxti0EKgCAQAD+UbVFGHaK3mJgaqyut0vejQ4eo0zAwA2cSmmI2MUMoImGxPjIk4iw2VP4Adurw0T6sNXMF/xeT9goFkqW3fKbsTDAMrgeLtCq8gyXM7dCNUjZy6vcLZTc31Q==?cssminify=yes' type='text/css' media='all' />
<script id='jetpack_related-posts-js-extra'>
var related_posts_js_options = {"post_heading":"h4"};
</script>
<script id='wpcom-actionbar-placeholder-js-extra'>
var actionbardata = {"siteID":"171792927","siteURL":"https:\/\/darrenmartyn.ie","xhrURL":"https:\/\/darrenmartyn.ie\/wp-admin\/admin-ajax.php","nonce":"c7dce5aac2","isLoggedIn":"","statusMessage":"","subsEmailDefault":"instantly","proxyScriptUrl":"https:\/\/s0.wp.com\/wp-content\/js\/wpcom-proxy-request.js?ver=20211021","shortlink":"https:\/\/wp.me\/pbCPbF-7V","i18n":{"followedText":"New posts from this site will now appear in your <a href=\"https:\/\/wordpress.com\/read\">Reader<\/a>","foldBar":"Collapse this bar","unfoldBar":"Expand this bar"}};
</script>
<script crossorigin='anonymous' type='text/javascript' src='https://s1.wp.com/_static/??/wp-content/js/mobile-useragent-info.js,/wp-content/mu-plugins/related-posts/related-posts.js,/wp-content/js/rlt-proxy.js?m=1637704497j'></script>
<script type='text/javascript'>
	window.addEventListener( 'DOMContentLoaded', function() {
		rltInitialize( {"token":null,"iframeOrigins":["https:\/\/widgets.wp.com"]} );
	} );
</script>
<link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://darrenmartynie.wordpress.com/xmlrpc.php?rsd" />
<link rel="wlwmanifest" type="application/wlwmanifest+xml" href="https://s1.wp.com/wp-includes/wlwmanifest.xml" /> 
<meta name="generator" content="WordPress.com" />
<link rel="canonical" href="https://darrenmartyn.ie/2021/11/29/analysis-of-the-lib__mdma-so-1-userland-rootkit/" />
<link rel='shortlink' href='https://wp.me/pbCPbF-7V' />
<link rel="alternate" type="application/json+oembed" href="https://public-api.wordpress.com/oembed/?format=json&amp;url=https%3A%2F%2Fdarrenmartyn.ie%2F2021%2F11%2F29%2Fanalysis-of-the-lib__mdma-so-1-userland-rootkit%2F&amp;for=wpcom-auto-discovery" /><link rel="alternate" type="application/xml+oembed" href="https://public-api.wordpress.com/oembed/?format=xml&amp;url=https%3A%2F%2Fdarrenmartyn.ie%2F2021%2F11%2F29%2Fanalysis-of-the-lib__mdma-so-1-userland-rootkit%2F&amp;for=wpcom-auto-discovery" />
<!-- Jetpack Open Graph Tags -->
<meta property="og:type" content="article" />
<meta property="og:title" content="Analysis of the &#8220;lib__mdma.so.1&#8221; userland rootkit" />
<meta property="og:url" content="https://darrenmartyn.ie/2021/11/29/analysis-of-the-lib__mdma-so-1-userland-rootkit/" />
<meta property="og:description" content="Note to the reader: This blogpost was written &#8220;as it happened&#8221;, so it may jump around the place a bit. I&#8217;ll try clean it up somewhat before I hit publish, but I probably won&amp;#8217…" />
<meta property="article:published_time" content="2021-11-29T11:13:30+00:00" />
<meta property="article:modified_time" content="2021-11-29T11:13:30+00:00" />
<meta property="og:site_name" content="Darren Martyn" />
<meta property="og:image" content="https://darrenmartynie.files.wordpress.com/2021/11/image.png" />
<meta property="og:image:width" content="723" />
<meta property="og:image:height" content="671" />
<meta property="og:image:alt" content="" />
<meta property="og:locale" content="en_GB" />
<meta name="twitter:text:title" content="Analysis of the &#8220;lib__mdma.so.1&#8221; userland&nbsp;rootkit" />
<meta name="twitter:image" content="https://darrenmartynie.files.wordpress.com/2021/11/image.png?w=640" />
<meta name="twitter:card" content="summary_large_image" />
<meta property="article:publisher" content="https://www.facebook.com/WordPresscom" />

<!-- End Jetpack Open Graph Tags -->
<link rel="shortcut icon" type="image/x-icon" href="https://s1.wp.com/i/favicon.ico" sizes="16x16 24x24 32x32 48x48" />
<link rel="icon" type="image/x-icon" href="https://s1.wp.com/i/favicon.ico" sizes="16x16 24x24 32x32 48x48" />
<link rel="apple-touch-icon" href="https://s2.wp.com/i/webclip.png" />
<link rel="search" type="application/opensearchdescription+xml" href="https://darrenmartyn.ie/osd.xml" title="Darren Martyn" />
<link rel="search" type="application/opensearchdescription+xml" href="https://s1.wp.com/opensearch.xml" title="WordPress.com" />
<link rel="pingback" href="https://darrenmartyn.ie/xmlrpc.php"><meta name="application-name" content="Darren Martyn" /><meta name="msapplication-window" content="width=device-width;height=device-height" /><meta name="msapplication-task" content="name=Subscribe;action-uri=https://darrenmartyn.ie/feed/;icon-uri=https://s1.wp.com/i/favicon.ico" /><meta name="msapplication-task" content="name=Sign up for a free blog;action-uri=http://wordpress.com/signup/;icon-uri=https://s1.wp.com/i/favicon.ico" /><meta name="msapplication-task" content="name=WordPress.com Support;action-uri=http://support.wordpress.com/;icon-uri=https://s1.wp.com/i/favicon.ico" /><meta name="msapplication-task" content="name=WordPress.com Forums;action-uri=http://forums.wordpress.com/;icon-uri=https://s1.wp.com/i/favicon.ico" /><meta name="description" content="Note to the reader: This blogpost was written &quot;as it happened&quot;, so it may jump around the place a bit. I&#039;ll try clean it up somewhat before I hit publish, but I probably won&#039;t have time to do much serious editing. Also, there is some value in showing the process, I guess. Or maybe that&hellip;" />
<link rel="amphtml" href="https://darrenmartyn.ie/2021/11/29/analysis-of-the-lib__mdma-so-1-userland-rootkit/amp/"><!-- Your Google Analytics Plugin is missing the tracking ID -->
</head>

<body class="post-template-default single single-post postid-491 single-format-standard wp-embed-responsive customizer-styles-applied singular image-filters-enabled highlander-enabled highlander-light">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-dark-grayscale"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0 0.49803921568627" /><feFuncG type="table" tableValues="0 0.49803921568627" /><feFuncB type="table" tableValues="0 0.49803921568627" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-grayscale"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0 1" /><feFuncG type="table" tableValues="0 1" /><feFuncB type="table" tableValues="0 1" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-purple-yellow"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0.54901960784314 0.98823529411765" /><feFuncG type="table" tableValues="0 1" /><feFuncB type="table" tableValues="0.71764705882353 0.25490196078431" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-blue-red"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0 1" /><feFuncG type="table" tableValues="0 0.27843137254902" /><feFuncB type="table" tableValues="0.5921568627451 0.27843137254902" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-midnight"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0 0" /><feFuncG type="table" tableValues="0 0.64705882352941" /><feFuncB type="table" tableValues="0 1" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-magenta-yellow"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0.78039215686275 1" /><feFuncG type="table" tableValues="0 0.94901960784314" /><feFuncB type="table" tableValues="0.35294117647059 0.47058823529412" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-purple-green"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0.65098039215686 0.40392156862745" /><feFuncG type="table" tableValues="0 1" /><feFuncB type="table" tableValues="0.44705882352941 0.4" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-blue-orange"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0.098039215686275 1" /><feFuncG type="table" tableValues="0 0.66274509803922" /><feFuncB type="table" tableValues="0.84705882352941 0.41960784313725" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><div id="page" class="site">
	<a class="skip-link screen-reader-text" href="#content">Skip to content</a>

		<header id="masthead" class="site-header">

			<div class="site-branding-container">
				<div class="site-branding">

								<p class="site-title"><a href="https://darrenmartyn.ie/" rel="home">Darren Martyn</a></p>
			
				<nav id="site-navigation" class="main-navigation" aria-label="Top Menu">
			<div class="menu-primary-container"><ul id="menu-primary" class="main-menu"><li id="menu-item-8" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-home menu-item-8"><a href="https://darrenmartyn.ie/">Home</a></li>
<li id="menu-item-27" class="menu-item menu-item-type-post_type menu-item-object-page current_page_parent menu-item-27"><a href="https://darrenmartyn.ie/blog/">Blog</a></li>
<li id="menu-item-36" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-36"><a href="https://darrenmartyn.ie/speaking/">Speaking</a></li>
<li id="menu-item-38" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-38"><a href="https://darrenmartyn.ie/about/">Contact</a></li>
</ul></div>
			<div class="main-menu-more">
				<ul class="main-menu">
					<li class="menu-item menu-item-has-children">
						<button class="submenu-expand main-menu-more-toggle is-empty" tabindex="-1"
							aria-label="More" aria-haspopup="true" aria-expanded="false"><svg class="svg-icon" width="24" height="24" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg"><g fill="none" fill-rule="evenodd"><path d="M0 0h24v24H0z"/><path fill="currentColor" fill-rule="nonzero" d="M12 2c5.52 0 10 4.48 10 10s-4.48 10-10 10S2 17.52 2 12 6.48 2 12 2zM6 14a2 2 0 1 0 0-4 2 2 0 0 0 0 4zm6 0a2 2 0 1 0 0-4 2 2 0 0 0 0 4zm6 0a2 2 0 1 0 0-4 2 2 0 0 0 0 4z"/></g></svg>
						</button>
						<ul class="sub-menu hidden-links">
							<li class="mobile-parent-nav-menu-item">
								<button class="menu-item-link-return"><svg class="svg-icon" width="24" height="24" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M15.41 7.41L14 6l-6 6 6 6 1.41-1.41L10.83 12z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg>Back
								</button>
							</li>
						</ul>
					</li>
				</ul>
			</div>		</nav><!-- #site-navigation -->
		</div><!-- .site-branding -->
			</div><!-- .site-branding-container -->

					</header><!-- #masthead -->

	<div id="content" class="site-content">

	<div id="primary" class="content-area">
		<main id="main" class="site-main">

			
<article id="post-491" class="post-491 post type-post status-publish format-standard hentry category-hacking category-backdoor category-malware tag-hacking tag-malware tag-ld_preload tag-backdoor tag-rootkit tag-ld-so-preload tag-userland-rootkit tag-reverse-engineering tag-ghidra entry">
		<header class="entry-header">
		
<h1 class="entry-title">Analysis of the &#8220;lib__mdma.so.1&#8221; userland&nbsp;rootkit</h1>
<div class="entry-meta">
	<span class="byline"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4zm0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted by</span><span class="author vcard"><a class="url fn n" href="https://darrenmartyn.ie/author/darrenmart/">darrenmart</a></span></span>	<span class="posted-on"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><path id="a" d="M0 0h24v24H0V0z"></path></defs><clipPath id="b"><use xlink:href="#a" overflow="visible"></use></clipPath><path clip-path="url(#b)" d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zm4.2 14.2L11 13V7h1.5v5.2l4.5 2.7-.8 1.3z"></path></svg><a href="https://darrenmartyn.ie/2021/11/29/analysis-of-the-lib__mdma-so-1-userland-rootkit/" rel="bookmark"><time class="entry-date published updated" datetime="2021-11-29T11:13:30+00:00">29th Nov 2021</time></a></span>	<span class="comment-count">
					</span>
	</div><!-- .entry-meta -->
	</header>
	
	<div class="entry-content">
		
<p>Note to the reader: This blogpost was written &#8220;as it happened&#8221;, so it may jump around the place a bit. I&#8217;ll try clean it up somewhat before I hit publish, but I probably won&#8217;t have time to do much serious editing. Also, there is some value in showing the process, I guess. Or maybe that is just me being too lazy and/or cheap to get the copy edited by someone who can write. Whatever.</p>



<p>A few years ago, a friend of mine <a href="https://www.youtube.com/watch?v=tj1rMU5uHoE" target="_blank" rel="noreferrer noopener">presented on the history of LD_PRELOAD based userland rootkits</a> on Linux. I later ended up doing my final year thesis on using memory forensics to analyse this class of rootkits. </p>



<p>One of the rootkits mentioned in Alastairs talk was &#8220;lib__mdma.so.1&#8221;, a rootkit found in the wild. Recently it came up in discussion over something else, so I went and googled it to see if I could find any reference to it.</p>



<p>Better than a reference, I found a sample. </p>



<figure class="wp-block-image size-large"><img data-attachment-id="495" data-permalink="https://darrenmartyn.ie/image-2/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image.png" data-orig-size="723,671" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image.png?w=640" src="https://darrenmartynie.files.wordpress.com/2021/11/image.png?w=723" alt="" class="wp-image-495" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image.png 723w, https://darrenmartynie.files.wordpress.com/2021/11/image.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image.png?w=300 300w" sizes="(max-width: 723px) 100vw, 723px" /></figure>



<p>Along with what appeared to be a sample installed on some probably hacked server, there were also some IRC chatlogs from 2013 of someone who had been infected with this rootkit. </p>



<p>I suspect the hfscc server is hacked, as the &#8220;berandal_sym&#8221; path is used by certain &#8220;symlink shells&#8221; to expose the filesystem to a browser. </p>



<p>We hit it up with curl, and notice that the servers telling us the file has been there since 2014 (based on last modified header).</p>



<figure class="wp-block-image size-large"><img data-attachment-id="498" data-permalink="https://darrenmartyn.ie/image-1-2/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-1.png" data-orig-size="863,491" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-1" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-1.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-1.png?w=640" src="https://darrenmartynie.files.wordpress.com/2021/11/image-1.png?w=863" alt="" class="wp-image-498" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-1.png 863w, https://darrenmartynie.files.wordpress.com/2021/11/image-1.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-1.png?w=300 300w, https://darrenmartynie.files.wordpress.com/2021/11/image-1.png?w=768 768w" sizes="(max-width: 863px) 100vw, 863px" /></figure>



<p>Naturally, our next step is to download the file and begin our analysis.</p>



<p>The MD5 hash of the file is: 16f09c76b455d7ac0540b015c6be4d1d, and that hash didn&#8217;t show up on VirusTotal. Interesting. So we have something &#8220;new&#8221; here.</p>



<p>Given its a shared object, and we pretty much suspect it to be an LD_PRELOAD based rootkit, we can look at its exported functions using <code>nm</code>, and filtering a little with <code>grep</code>.</p>



<figure class="wp-block-image size-large"><img data-attachment-id="503" data-permalink="https://darrenmartyn.ie/image-3/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-3.png" data-orig-size="585,453" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-3" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-3.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-3.png?w=585" src="https://darrenmartynie.files.wordpress.com/2021/11/image-3.png?w=585" alt="" class="wp-image-503" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-3.png 585w, https://darrenmartynie.files.wordpress.com/2021/11/image-3.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-3.png?w=300 300w" sizes="(max-width: 585px) 100vw, 585px" /></figure>



<p>From a first look, it appears to be a Jynx variant (Jynx parent?), what with the presence of functions like <code>drop_dup_shell</code>, and <code>drop_suid_shell_if_env_set</code>, etc. </p>



<p>I figured the best thing to get a disassembler or decompiler take a look at some of these functions.</p>



<p>I originally was going to use radare2 for this blog post, which I quite like, but when I ran it and told it to super auto analyse, it told me that an r2 developer would come around and do the hard work for me. After putting the kettle on and waiting a while, this did not occur. </p>



<p>Maybe I pressed the wrong &#8220;any&#8221; key?</p>



<figure class="wp-block-image size-large"><img data-attachment-id="572" data-permalink="https://darrenmartyn.ie/image-23/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-23.png" data-orig-size="837,151" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-23" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-23.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-23.png?w=640" src="https://darrenmartynie.files.wordpress.com/2021/11/image-23.png?w=837" alt="" class="wp-image-572" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-23.png 837w, https://darrenmartynie.files.wordpress.com/2021/11/image-23.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-23.png?w=300 300w, https://darrenmartynie.files.wordpress.com/2021/11/image-23.png?w=768 768w" sizes="(max-width: 837px) 100vw, 837px" /></figure>



<p> So I got Ghidra out instead (because the screenshots were easier to deal with, mostly). A lot of the initial poking about was done with r2. </p>



<p>We will start with <code>drop_suid_shell_if_env_set</code>, a screenshot of its decompilation is below.</p>



<figure class="wp-block-image size-large"><img data-attachment-id="506" data-permalink="https://darrenmartyn.ie/image-4/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-4.png" data-orig-size="395,508" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-4" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-4.png?w=233" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-4.png?w=395" src="https://darrenmartynie.files.wordpress.com/2021/11/image-4.png?w=395" alt="" class="wp-image-506" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-4.png 395w, https://darrenmartynie.files.wordpress.com/2021/11/image-4.png?w=117 117w, https://darrenmartynie.files.wordpress.com/2021/11/image-4.png?w=233 233w" sizes="(max-width: 395px) 100vw, 395px" /></figure>



<p>So what this function does, is check for the existence of an environmental variable (named &#8220;hax&#8221;). If this environmental variable is set, and it is being called from a process where <code>euid=0</code>, we unset the &#8220;hax&#8221; environmental variable, set a few new environmental variables, and execute a shell with its process name set to <code>__mdma</code>. </p>



<p>Similar code can be found in the Jynx2 rootkit, <a href="https://github.com/chokepoint/Jynx2/blob/master/jynx2.c#L640,L663" target="_blank" rel="noreferrer noopener">linked here</a>.</p>



<p>I believe can trigger this backdoor on the infected box with the following incantation: <code>hax=lol sudo</code>, where &#8220;sudo&#8221; can be any setuid-root binary. We will test this hypothesis later when we infect a box with the rootkit for science purposes.</p>



<p>The next interesting function (to me, anyway) is the remote backdoor. Like Jynx2, it uses an <code>accept()</code> hook. Unlike Jynx2, it seems to forego bringing a heap of OpenSSL cruft with it, and doesn&#8217;t bother encrypting the shell connection. This <code>drop_dup_shell</code> function gets checked every time <code>accept()</code> is called, being passed the <code>sockfd</code> and <code>sockaddr</code> of the accepted connection. If some checks pass, you get a shell. Otherwise, the socket is passed back unharmed.</p>



<p>We can check the <code>accept</code> function to verify that <code>drop_dup_shell</code> is called:</p>



<figure class="wp-block-image size-large"><img data-attachment-id="521" data-permalink="https://darrenmartyn.ie/image-7/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-7.png" data-orig-size="474,281" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-7" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-7.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-7.png?w=474" src="https://darrenmartynie.files.wordpress.com/2021/11/image-7.png?w=474" alt="" class="wp-image-521" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-7.png 474w, https://darrenmartynie.files.wordpress.com/2021/11/image-7.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-7.png?w=300 300w" sizes="(max-width: 474px) 100vw, 474px" /></figure>



<p>What are these checks? Well, its actually kind of simple. It checks if the connecting clients source port is between a certain range, and then waits for a password to be input. We can see this in the screenshot below. I did some light renaming of a couple of variables, and added comments for readability.</p>



<figure class="wp-block-image size-large"><img data-attachment-id="513" data-permalink="https://darrenmartyn.ie/image-5/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-5.png" data-orig-size="753,933" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-5" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-5.png?w=242" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-5.png?w=640" src="https://darrenmartynie.files.wordpress.com/2021/11/image-5.png?w=753" alt="" class="wp-image-513" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-5.png 753w, https://darrenmartynie.files.wordpress.com/2021/11/image-5.png?w=121 121w, https://darrenmartynie.files.wordpress.com/2021/11/image-5.png?w=242 242w" sizes="(max-width: 753px) 100vw, 753px" /></figure>



<p>Basically, if our source port is between 2318 and 2351, and we enter the password &#8220;charm@nte!&#8221;, we get a shell. It would appear that the shell even tries launch a PTY for actually interactive hacking. We can also note that the shell process is launched with the process name <code>__mdma</code> again. It also prints some welcome messages. </p>



<p>When we search Google for that password, we come across this blog post which mentions it as the password for a botnet&#8217;s C&amp;C IRC: <a href="https://www.exposedbotnets.com/2011/07/7411756213irc-botnet-hosted-in-united.html" target="_blank" rel="noreferrer noopener">https://www.exposedbotnets.com/2011/07/7411756213irc-botnet-hosted-in-united.html</a></p>



<p>Interestingly, that botnets port number was 2319 &#8211; a port within the &#8220;magic range&#8221; of our backdoor here. I&#8217;m not saying its the same actor, but I&#8217;m saying its the same actor. If that actor happens to be you, get in touch. I&#8217;m curious how this project ended up being developed!</p>



<p>The next function of interest is <code>connecting_pty_shell_signalhandler</code>, mostly because we were able to attribute that code with supreme levels of confidence as having been copy-pasted from somewhere else.</p>



<p>Look at this decompiler view.</p>



<figure class="wp-block-image size-large"><img data-attachment-id="518" data-permalink="https://darrenmartyn.ie/image-6/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-6.png" data-orig-size="482,323" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-6" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-6.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-6.png?w=482" src="https://darrenmartynie.files.wordpress.com/2021/11/image-6.png?w=482" alt="" class="wp-image-518" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-6.png 482w, https://darrenmartynie.files.wordpress.com/2021/11/image-6.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-6.png?w=300 300w" sizes="(max-width: 482px) 100vw, 482px" /></figure>



<p>Now compare it to this piece of code: <a href="https://github.com/petikvx/malwares-collection/blob/7ec1e7e0d2f6e28baa651eec5bacaeaba4cca4bb/Binary/C-CPP-Go-Rust/Backdoor/Linux/Backdoor.Linux.Rrs/rrs.c#L602,L624" target="_blank" rel="noreferrer noopener">rrs.c</a></p>



<p>Its the same code. A switch/case block of stuff to handle signals. The backdoor tool &#8220;rrs&#8221; is worth looking at, and I actually planned to write a bit about it at some point. It is genuinely neat, offering a full TTY, compiling (sometimes) on many platforms, and optionally using OpenSSL for encrypting its connections.</p>



<p>The next interesting bits are the installation and uninstall routines, which are pretty simple &#8211; they both open <code>/etc/ld.so.preload</code> and write to them. Install writes the libraries path, uninstall wipes it out. I think.</p>



<p>Here is the install routine.</p>



<figure class="wp-block-image size-large"><img data-attachment-id="524" data-permalink="https://darrenmartyn.ie/image-8/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-8.png" data-orig-size="520,284" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-8" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-8.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-8.png?w=520" src="https://darrenmartynie.files.wordpress.com/2021/11/image-8.png?w=520" alt="" class="wp-image-524" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-8.png 520w, https://darrenmartynie.files.wordpress.com/2021/11/image-8.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-8.png?w=300 300w" sizes="(max-width: 520px) 100vw, 520px" /></figure>



<p>And here is the uninstaller.</p>



<figure class="wp-block-image size-large"><img data-attachment-id="526" data-permalink="https://darrenmartyn.ie/image-9/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-9.png" data-orig-size="524,293" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-9" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-9.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-9.png?w=524" src="https://darrenmartynie.files.wordpress.com/2021/11/image-9.png?w=524" alt="" class="wp-image-526" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-9.png 524w, https://darrenmartynie.files.wordpress.com/2021/11/image-9.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-9.png?w=300 300w" sizes="(max-width: 524px) 100vw, 524px" /></figure>



<p>This category of rootkits all install/uninstall the same way, though many of them rely on an external installer script to do this for them. </p>



<p>So far what we have is a persistent backdoor that can allow remote access and privilege escalation. It also has proper rootkit features, and we are going to get into those next, exploring them with static analysis until we get bored of that.</p>



<p>This rootkit can hide files, directories, network connections, and processes, like any good rootkit should. There is also a weird execve hook that does some stuff that I also need to understand fully, we will explore all these below. </p>



<p>We will start with the execve hook. Its too long to post inline, so you can find the decompiled source code of it <a href="https://gist.github.com/darrenmartyn/1c67cbbee5b58eba3f4689b1724e2e7e" target="_blank" rel="noreferrer noopener">in this gist</a>.</p>



<p>My understanding of this clusterfuck of &#8220;if&#8221; statements is that the rootkit checks (using <code>strstr</code>) if the executed command is one of a list of ones it doesn&#8217;t want to fuck with. If it is, it uninstalls itself, forks, waits for the process to finish, and reinstalls itself. </p>



<p>I&#8217;m guessing that this &#8220;block list&#8221; of processes to avoid infecting was found using trial and error. It includes <code>rkhunter</code> and <code>ldd</code>, both of which could uncover an active infection, so this probably is a way to evade detection as well as avoid causing system instability. After all, usually people detect these rootkits because some process is breaking horribly. We will be able to try validate this finding later on, by doing dynamic analysis.</p>



<p>Next we will look at each of the hooks, in turn. This is not going to be very exciting, most of the hooks are pretty similar. I&#8217;d recommend looking at the Jynx2 source code for very, very similar (if not identical) hooks.</p>



<p>A bunch of the hooks call a function named <code>is_invisible</code>, so I&#8217;ll quickly cover that first. This function acts as a kind of filter, using <code>strstr</code> to compare the input (which is of type <code>char</code>) to a couple of strings. If the string is either <code>ld.so.preload</code> or <code>__mdma</code>, it returns telling the calling function that this string is, in fact, meant to be invisible. </p>



<figure class="wp-block-image size-large"><img data-attachment-id="537" data-permalink="https://darrenmartyn.ie/image-10/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-10.png" data-orig-size="745,639" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-10" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-10.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-10.png?w=640" src="https://darrenmartynie.files.wordpress.com/2021/11/image-10.png?w=745" alt="" class="wp-image-537" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-10.png 745w, https://darrenmartynie.files.wordpress.com/2021/11/image-10.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-10.png?w=300 300w" sizes="(max-width: 745px) 100vw, 745px" /></figure>



<p>The <code>__xstat</code> and <code>__xstat64</code> hooks are virtually identical, so I&#8217;ll just show a decompilation of the <code>__xstat</code> hook below. These hooks define the real <code>__xstat</code> function as <code>old_xstat</code>, do a call to the <code>drop_suid_shell_if_env_set</code> function to trigger that backdoor, and then pass the input filename to <code>is_invisible</code>. </p>



<p>If <code>is_invisible</code> returns 0, indicating that there is nothing to hide this time, the real <code>__xstat</code> function is called (as <code>old_xstat</code>). Otherwise, they hide the file being checked by returning <code>-1</code>. </p>



<figure class="wp-block-image size-large"><img data-attachment-id="539" data-permalink="https://darrenmartyn.ie/image-11/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-11.png" data-orig-size="432,408" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-11" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-11.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-11.png?w=432" src="https://darrenmartynie.files.wordpress.com/2021/11/image-11.png?w=432" alt="" class="wp-image-539" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-11.png 432w, https://darrenmartynie.files.wordpress.com/2021/11/image-11.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-11.png?w=300 300w" sizes="(max-width: 432px) 100vw, 432px" /></figure>



<p> The <code>exit</code> hook is rather simple, and doesn&#8217;t do much at all. It just acts as another way to call <code>drop_suid_shell_if_env_set</code> and then calls the real exit, by the same method as other hooks &#8211; defining the real <code>exit</code> from <code>libc</code> as <code>old_exit</code>.</p>



<figure class="wp-block-image size-large"><img data-attachment-id="541" data-permalink="https://darrenmartyn.ie/image-12/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-12.png" data-orig-size="432,214" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-12" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-12.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-12.png?w=432" src="https://darrenmartynie.files.wordpress.com/2021/11/image-12.png?w=432" alt="" class="wp-image-541" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-12.png 432w, https://darrenmartynie.files.wordpress.com/2021/11/image-12.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-12.png?w=300 300w" sizes="(max-width: 432px) 100vw, 432px" /></figure>



<p><code>fopen</code> and <code>fopen64</code> hooks are pretty much the same, so I will just show <code>fopen</code>. These ones are a bit more interesting &#8211; they set up the &#8220;real <code>fopen</code>&#8221; (or <code>fopen64</code>) as <code>old_fopen</code> (or <code>old_fopen64</code>), and then do some extra checks. </p>



<p>In the event that <code>/proc/net/tcp</code> or <code>/proc/net/tcp6</code> are opened, they redirect to a function named <code>forge_proc_net_tcp</code> in order to hide network connections. </p>



<p>In the event that the path starts with <code>/proc/</code> and ends with <code>maps</code>, the function <code>forge_proc_pid_maps</code> is called to hide entries from <code>/proc/PID/maps</code>.</p>



<figure class="wp-block-image size-large"><img data-attachment-id="544" data-permalink="https://darrenmartyn.ie/image-13/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-13.png" data-orig-size="712,414" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-13" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-13.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-13.png?w=640" src="https://darrenmartynie.files.wordpress.com/2021/11/image-13.png?w=712" alt="" class="wp-image-544" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-13.png 712w, https://darrenmartynie.files.wordpress.com/2021/11/image-13.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-13.png?w=300 300w" sizes="(max-width: 712px) 100vw, 712px" /></figure>



<p>The <code>forge_proc_net_tcp</code> function is, to put it bluntly, a fucking mess. It basically checks if the remote or local port is within the magic range of ports to hide, it filters the connection from the output and returns a painfully crafted fake response.</p>



<figure class="wp-block-image size-large"><img data-attachment-id="546" data-permalink="https://darrenmartyn.ie/image-14/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-14.png" data-orig-size="695,778" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-14" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-14.png?w=268" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-14.png?w=640" src="https://darrenmartynie.files.wordpress.com/2021/11/image-14.png?w=695" alt="" class="wp-image-546" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-14.png 695w, https://darrenmartynie.files.wordpress.com/2021/11/image-14.png?w=134 134w, https://darrenmartynie.files.wordpress.com/2021/11/image-14.png?w=268 268w" sizes="(max-width: 695px) 100vw, 695px" /></figure>



<p>The <code>forge_proc_pid_maps</code> function is quite similar &#8211; it checks if the string <code>__mdma</code> is in the <code>/proc/PID/maps</code> output, removes it, and passes back a faked result, hiding the existence of the hook. </p>



<figure class="wp-block-image size-large"><img data-attachment-id="548" data-permalink="https://darrenmartyn.ie/image-15/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-15.png" data-orig-size="575,450" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-15" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-15.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-15.png?w=575" src="https://darrenmartynie.files.wordpress.com/2021/11/image-15.png?w=575" alt="" class="wp-image-548" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-15.png 575w, https://darrenmartynie.files.wordpress.com/2021/11/image-15.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-15.png?w=300 300w" sizes="(max-width: 575px) 100vw, 575px" /></figure>



<p>The <code>open</code> hook is kind of neat, it just does some basic filtering on filenames to try avoid  <code>utmp</code>, <code>btmp</code> or <code>wtmp</code> to avoid getting logged. </p>



<figure class="wp-block-image size-large"><img data-attachment-id="550" data-permalink="https://darrenmartyn.ie/image-16/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-16.png" data-orig-size="690,374" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-16" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-16.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-16.png?w=640" src="https://darrenmartynie.files.wordpress.com/2021/11/image-16.png?w=690" alt="" class="wp-image-550" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-16.png 690w, https://darrenmartynie.files.wordpress.com/2021/11/image-16.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-16.png?w=300 300w" sizes="(max-width: 690px) 100vw, 690px" /></figure>



<p><code>readdir</code> and <code>readdir64</code> hooks are basically the same, so as usual, I&#8217;ll just cover <code>readdir</code>. </p>



<p>This hook checks if the path contains <code>/proc</code>, passes it on to <code>is_invisible</code> if so, and also checks for the presence of <code>__mdma</code> and <code>ld.so.preload</code>, returning null <code>dirent</code> values if so, in order to hide these files.</p>



<figure class="wp-block-image size-large"><img data-attachment-id="553" data-permalink="https://darrenmartyn.ie/image-17/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-17.png" data-orig-size="706,504" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-17" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-17.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-17.png?w=640" src="https://darrenmartynie.files.wordpress.com/2021/11/image-17.png?w=706" alt="" class="wp-image-553" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-17.png 706w, https://darrenmartynie.files.wordpress.com/2021/11/image-17.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-17.png?w=300 300w" sizes="(max-width: 706px) 100vw, 706px" /></figure>



<p>Ok, now to the last two. These two are a bit fucking weird.</p>



<p>I&#8217;ll be honest, I have no idea what exactly <code>strnvis</code> is for. So I&#8217;ll just guess its to hide a string? Anyway, this hook compares to see if the string <code>klikevil</code> is in the <code>dst</code> parameter. If it is, unless I&#8217;m terribly mistaken, it filters it out. I guess this is something for avoiding logging? Maybe its unfinished?</p>



<figure class="wp-block-image size-large"><img data-attachment-id="555" data-permalink="https://darrenmartyn.ie/image-18/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-18.png" data-orig-size="492,320" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-18" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-18.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-18.png?w=492" src="https://darrenmartynie.files.wordpress.com/2021/11/image-18.png?w=492" alt="" class="wp-image-555" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-18.png 492w, https://darrenmartynie.files.wordpress.com/2021/11/image-18.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-18.png?w=300 300w" sizes="(max-width: 492px) 100vw, 492px" /></figure>



<p>The <code>write</code> hook is similar &#8211; it specifically filters out the string <code>klikevil</code> from being written. I think? Pretty tired at this point. So instead, I&#8217;ll just be wrong and someone can correct me on twitter.</p>



<figure class="wp-block-image size-large"><img data-attachment-id="557" data-permalink="https://darrenmartyn.ie/image-19/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-19.png" data-orig-size="655,300" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-19" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-19.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-19.png?w=640" src="https://darrenmartynie.files.wordpress.com/2021/11/image-19.png?w=655" alt="" class="wp-image-557" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-19.png 655w, https://darrenmartynie.files.wordpress.com/2021/11/image-19.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-19.png?w=300 300w" sizes="(max-width: 655px) 100vw, 655px" /></figure>



<p>We have now somewhat exhaustively covered literally every hook in this piece of malware. Not as in depth as some would like, and there is a distinct lack of the mandatory IDA Pro Call Graphs that would show I&#8217;m a real reverse engineer (I&#8217;m not), but I think this gives us a fairly good picture of the malwares capabilities, and gives us some theories to test out when we actually infect a virtual machine with it.</p>



<p>Given its from 2014, my first thought was &#8220;right, lets find an Ubuntu from sometime around then and fuck it up&#8221;. So we go and get an ISO, get VirtualBox installed, and get to work.</p>



<p>We went and downloaded the i386 Ubuntu 14.04 ISO, and prayed to the gods that somehow, it would install without any fucking about. This was the hardest bit, as for whatever reason the install media had an exceptionally hard time installing grub.</p>



<p>We dropped our backdoor library in <code>/lib/lib__mdma.so</code>.1 and entered this path into <code>/etc.ld.so.preload</code>, and now we can test some theories out.</p>



<p>Firstly, lets try elevate our privileges. We run <code>hax=lol sudo -l</code> and then CTRL+C, and note it drops us into a root shell.</p>



<figure class="wp-block-image size-large"><img data-attachment-id="562" data-permalink="https://darrenmartyn.ie/image-20/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-20.png" data-orig-size="1135,102" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-20" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-20.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-20.png?w=640" src="https://darrenmartynie.files.wordpress.com/2021/11/image-20.png?w=1024" alt="" class="wp-image-562" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-20.png?w=1024 1024w, https://darrenmartynie.files.wordpress.com/2021/11/image-20.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-20.png?w=300 300w, https://darrenmartynie.files.wordpress.com/2021/11/image-20.png?w=768 768w, https://darrenmartynie.files.wordpress.com/2021/11/image-20.png 1135w" sizes="(max-width: 1024px) 100vw, 1024px" /></figure>



<p>Next, lets try the <code>accept()</code> hook. I noticed that this was somewhat broken &#8211; it wasn&#8217;t playing nice with <code>sshd</code> or <code>apache2</code> for whatever reason, so I just spun up a <code>netcat</code> listener on port 81 with <code>nc -lvp 81</code> to test it. We then connected to it using <code>ncat -p 2340 192.168.0.123 81</code> from our other host.</p>



<figure class="wp-block-image size-large"><img data-attachment-id="564" data-permalink="https://darrenmartyn.ie/image-21/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-21.png" data-orig-size="1144,585" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-21" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-21.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-21.png?w=640" src="https://darrenmartynie.files.wordpress.com/2021/11/image-21.png?w=1024" alt="" class="wp-image-564" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-21.png?w=1024 1024w, https://darrenmartynie.files.wordpress.com/2021/11/image-21.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-21.png?w=300 300w, https://darrenmartynie.files.wordpress.com/2021/11/image-21.png?w=768 768w, https://darrenmartynie.files.wordpress.com/2021/11/image-21.png 1144w" sizes="(max-width: 1024px) 100vw, 1024px" /></figure>



<p>I notice it tries to spawn a TTY, so I tried get it working with <code>socat</code>, but had no luck, so I decided to see if I could get the accept backdoor and environment backdoor working in tandem.</p>



<figure class="wp-block-image size-large"><img data-attachment-id="566" data-permalink="https://darrenmartyn.ie/image-22/" data-orig-file="https://darrenmartynie.files.wordpress.com/2021/11/image-22.png" data-orig-size="1132,446" data-comments-opened="0" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="image-22" data-image-description="" data-image-caption="" data-medium-file="https://darrenmartynie.files.wordpress.com/2021/11/image-22.png?w=300" data-large-file="https://darrenmartynie.files.wordpress.com/2021/11/image-22.png?w=640" src="https://darrenmartynie.files.wordpress.com/2021/11/image-22.png?w=1024" alt="" class="wp-image-566" srcset="https://darrenmartynie.files.wordpress.com/2021/11/image-22.png?w=1024 1024w, https://darrenmartynie.files.wordpress.com/2021/11/image-22.png?w=150 150w, https://darrenmartynie.files.wordpress.com/2021/11/image-22.png?w=300 300w, https://darrenmartynie.files.wordpress.com/2021/11/image-22.png?w=768 768w, https://darrenmartynie.files.wordpress.com/2021/11/image-22.png 1132w" sizes="(max-width: 1024px) 100vw, 1024px" /></figure>



<p>I also tested to see if files named <code>__mdma</code> were visible &#8211; they were not! So that filtering clearly works!</p>



<p>Interestingly, every so often the backdoor would uninstall itself. I&#8217;m not sure why, I think I was triggering one of its &#8220;remove itself and then reinstall&#8221; conditions. I didn&#8217;t investigate this further due to lack of time.</p>



<p>I tried to see what would happen if I created a file containing the string <code>klikevil</code>, but nothing interesting seemed to happen, so I&#8217;m not really sure whats going on there. That <code>write</code> and <code>strnvis</code> hook will remain somewhat of a mystery, I guess, for now. Maybe an Actual Reverse Engineer can work it out &#8211; someone who has IDA Pro Call Graphs in their blog posts.</p>



<p>I then checked if the backdoor shell connection showed up in <code>netstat</code>, and it was successfully filtered out. Very nice. </p>



<p>The final test was rebooting the VM. Does it reboot? Does the preload hook fuck up the entire thing? Does it actually persist?</p>



<p>After all, in the IRC logs it seemed someone was having serious issues with this rootkit fucking up their systems ability to function at all. So I rebooted the VM and waited. It seemed to be taking its sweet time coming back to life. Was it going to make it? Who knows. I went and put the kettle on.</p>



<p>Nope. Dear reader, the poor system was completely fucking hosed. </p>



<p>I managed to get it into recovery boot, mount the filesystem r/w and drop to a root shell, which allowed cleaning it up (by deleting /etc/ld.so.preload), but it appears that <code>plymouth</code> was having a Big Sad caused by some part of the rootkit crashing. </p>



<p>This is entirely possibly down to just weird fuckery to do with compiling a shared library on one box, and running it on another. Without access to source code or the exact target host? I&#8217;ll never know if this thing doesn&#8217;t just crash all the time. </p>



<p>So in summary, this malware has the following features:</p>



<ul><li>Remote access using an <code>accept()</code> based hook.</li><li>Local privilege elevation using a magic-environmental variable.</li><li>Post-reboot persistence (in theory!)</li><li>Hides files containing the string <code>__mdma</code></li><li>Hides directories containing the string <code>__mdma</code></li><li>Hides processes containing the string <code>__mdma</code></li><li>Can hide network connections from netstat, etc.</li><li>Userland based rootkit of the LD_PRELOAD class.</li></ul>



<p>I think that just about wraps this one up, to be honest. I was considering memory dumping the VM and doing analysis in Volatility or similar, but I might do that in a future blog post if there is interest.</p>



<p>I also considered doing some IoC&#8217;s or something, but that could be a future blog post. Deadline has been hit on this one tbh.</p>



<p>The sample has been uploaded to VirusTotal here: <a href="https://www.virustotal.com/gui/file-analysis/MTZmMDljNzZiNDU1ZDdhYzA1NDBiMDE1YzZiZTRkMWQ6MTYzODE4NDMwMw==" target="_blank" rel="noreferrer noopener">VirusTotal</a></p>



<p>You can also download the sample here:<a rel="noreferrer noopener" href="https://github.com/darrenmartyn/malware_samples/tree/main/2021/Nov/lib__mdma.so.1" target="_blank"> Github &#8211; Malware Sample</a><a href="https://github.com/darrenmartyn/malware_samples/tree/main/2021/Nov/lib__mdma.so.1" target="_blank" rel="noreferrer noopener">s</a></p>



<p></p>



<p></p>



<p></p>
<div id="jp-post-flair" class="sharedaddy sd-like-enabled sd-sharing-enabled"><div class="sharedaddy sd-sharing-enabled"><div class="robots-nocontent sd-block sd-social sd-social-icon-text sd-sharing"><h3 class="sd-title">Share this:</h3><div class="sd-content"><ul><li class="share-twitter"><a rel="nofollow noopener noreferrer" data-shared="sharing-twitter-491" class="share-twitter sd-button share-icon" href="https://darrenmartyn.ie/2021/11/29/analysis-of-the-lib__mdma-so-1-userland-rootkit/?share=twitter" target="_blank" title="Click to share on Twitter"><span>Twitter</span></a></li><li class="share-facebook"><a rel="nofollow noopener noreferrer" data-shared="sharing-facebook-491" class="share-facebook sd-button share-icon" href="https://darrenmartyn.ie/2021/11/29/analysis-of-the-lib__mdma-so-1-userland-rootkit/?share=facebook" target="_blank" title="Click to share on Facebook"><span>Facebook</span></a></li><li class="share-end"></li></ul></div></div></div><div class='sharedaddy sd-block sd-like jetpack-likes-widget-wrapper jetpack-likes-widget-unloaded' id='like-post-wrapper-171792927-491-61c515dd2a890' data-src='//widgets.wp.com/likes/index.html?ver=20211208#blog_id=171792927&amp;post_id=491&amp;origin=darrenmartynie.wordpress.com&amp;obj_id=171792927-491-61c515dd2a890&amp;domain=darrenmartyn.ie' data-name='like-post-frame-171792927-491-61c515dd2a890' data-title='Like or Reblog'><h3 class='sd-title'>Like this:</h3><div class='likes-widget-placeholder post-likes-widget-placeholder' style='height: 55px;'><span class='button'><span>Like</span></span> <span class="loading">Loading...</span></div><span class='sd-text-color'></span><a class='sd-link-color'></a></div>
<div id='jp-relatedposts' class='jp-relatedposts' >
	<h3 class="jp-relatedposts-headline"><em>Related</em></h3>
</div></div>	</div><!-- .entry-content -->

	<footer class="entry-footer">
		<span class="byline"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4zm0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted by</span><span class="author vcard"><a class="url fn n" href="https://darrenmartyn.ie/author/darrenmart/">darrenmart</a></span></span><span class="posted-on"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><path id="a" d="M0 0h24v24H0V0z"></path></defs><clipPath id="b"><use xlink:href="#a" overflow="visible"></use></clipPath><path clip-path="url(#b)" d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zm4.2 14.2L11 13V7h1.5v5.2l4.5 2.7-.8 1.3z"></path></svg><a href="https://darrenmartyn.ie/2021/11/29/analysis-of-the-lib__mdma-so-1-userland-rootkit/" rel="bookmark"><time class="entry-date published updated" datetime="2021-11-29T11:13:30+00:00">29th Nov 2021</time></a></span><span class="cat-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted in</span><a href="https://darrenmartyn.ie/tag/hacking/" rel="category tag">hacking</a>, <a href="https://darrenmartyn.ie/category/backdoor/" rel="category tag">backdoor</a>, <a href="https://darrenmartyn.ie/category/malware/" rel="category tag">malware</a></span><span class="tags-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M21.41 11.58l-9-9C12.05 2.22 11.55 2 11 2H4c-1.1 0-2 .9-2 2v7c0 .55.22 1.05.59 1.42l9 9c.36.36.86.58 1.41.58.55 0 1.05-.22 1.41-.59l7-7c.37-.36.59-.86.59-1.41 0-.55-.23-1.06-.59-1.42zM5.5 7C4.67 7 4 6.33 4 5.5S4.67 4 5.5 4 7 4.67 7 5.5 6.33 7 5.5 7z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Tags: </span><a href="https://darrenmartyn.ie/tag/hacking/" rel="tag">hacking</a>, <a href="https://darrenmartyn.ie/tag/malware/" rel="tag">malware</a>, <a href="https://darrenmartyn.ie/tag/ld_preload/" rel="tag">LD_PRELOAD</a>, <a href="https://darrenmartyn.ie/tag/backdoor/" rel="tag">backdoor</a>, <a href="https://darrenmartyn.ie/tag/rootkit/" rel="tag">rootkit</a>, <a href="https://darrenmartyn.ie/tag/ld-so-preload/" rel="tag">ld.so.preload</a>, <a href="https://darrenmartyn.ie/tag/userland-rootkit/" rel="tag">userland rootkit</a>, <a href="https://darrenmartyn.ie/tag/reverse-engineering/" rel="tag">reverse engineering</a>, <a href="https://darrenmartyn.ie/tag/ghidra/" rel="tag">ghidra</a></span>	</footer><!-- .entry-footer -->

				
</article><!-- #post-491 -->

	<nav class="navigation post-navigation" role="navigation" aria-label="Posts">
		<h2 class="screen-reader-text">Post navigation</h2>
		<div class="nav-links"><div class="nav-previous"><a href="https://darrenmartyn.ie/2021/11/22/openssl-engines-for-linux-persistence/" rel="prev"><span class="meta-nav" aria-hidden="true">Previous Post</span> <span class="screen-reader-text">Previous post:</span> <br/><span class="post-title">OpenSSL Engines for Linux&nbsp;Persistence</span></a></div></div>
	</nav>
		</main><!-- #main -->
	</div><!-- #primary -->


	</div><!-- #content -->

	<footer id="colophon" class="site-footer">
				<div class="site-info">
										<a class="site-name" href="https://darrenmartyn.ie/" rel="home">Darren Martyn</a><span class="comma">,</span>
						<a href="https://wordpress.com/?ref=footer_segment_professional" rel="nofollow">Powered by WordPress.com.</a>
										<nav class="footer-navigation" aria-label="Footer Menu">
					<div class="menu-primary-container"><ul id="menu-primary-1" class="footer-menu"><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-home menu-item-8"><a href="https://darrenmartyn.ie/">Home</a></li>
<li class="menu-item menu-item-type-post_type menu-item-object-page current_page_parent menu-item-27"><a href="https://darrenmartyn.ie/blog/">Blog</a></li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-36"><a href="https://darrenmartyn.ie/speaking/">Speaking</a></li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-38"><a href="https://darrenmartyn.ie/about/">Contact</a></li>
</ul></div>				</nav><!-- .footer-navigation -->
					</div><!-- .site-info -->
	</footer><!-- #colophon -->

</div><!-- #page -->

<!--  -->
<script src='//0.gravatar.com/js/gprofiles.js?ver=202151y' id='grofiles-cards-js'></script>
<script id='wpgroho-js-extra'>
var WPGroHo = {"my_hash":""};
</script>
<script crossorigin='anonymous' type='text/javascript' src='https://s1.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240h'></script>

	<script>
		// Initialize and attach hovercards to all gravatars
		( function() {
			function init() {
				if ( typeof Gravatar === 'undefined' ) {
					return;
				}

				if ( typeof Gravatar.init !== 'function' ) {
					return;
				}

				Gravatar.profile_cb = function ( hash, id ) {
					WPGroHo.syncProfileData( hash, id );
				};

				Gravatar.my_hash = WPGroHo.my_hash;
				Gravatar.init( 'body', '#wp-admin-bar-my-account' );
			}

			if ( document.readyState !== 'loading' ) {
				init();
			} else {
				document.addEventListener( 'DOMContentLoaded', init );
			}
		} )();
	</script>

		<div style="display:none">
	</div>
	<div id="actionbar" style="display: none;"
			class="actnbr-pub-twentynineteen actnbr-has-follow">
		<ul>
								<li class="actnbr-btn actnbr-hidden">
								<a class="actnbr-action actnbr-actn-follow " href="">
			<svg class="gridicon gridicons-reader-follow" height="24" width="24" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><g><path d="M23 16v2h-3v3h-2v-3h-3v-2h3v-3h2v3h3zM20 2v9h-4v3h-3v4H4c-1.1 0-2-.9-2-2V2h18zM8 13v-1H4v1h4zm3-3H4v1h7v-1zm0-2H4v1h7V8zm7-4H4v2h14V4z"/></g></svg><span>Follow</span>
		</a>
		<a class="actnbr-action actnbr-actn-following  no-display" href="">
			<svg class="gridicon gridicons-reader-following" height="24" width="24" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><g><path d="M23 13.482L15.508 21 12 17.4l1.412-1.388 2.106 2.188 6.094-6.094L23 13.482zm-7.455 1.862L20 10.89V2H2v14c0 1.1.9 2 2 2h4.538l4.913-4.832 2.095 2.176zM8 13H4v-1h4v1zm3-2H4v-1h7v1zm0-2H4V8h7v1zm7-3H4V4h14v2z"/></g></svg><span>Following</span>
		</a>
							<div class="actnbr-popover tip tip-top-left actnbr-notice" id="follow-bubble">
							<div class="tip-arrow"></div>
							<div class="tip-inner actnbr-follow-bubble">
															<ul>
											<li class="actnbr-sitename">
			<a href="https://darrenmartyn.ie">
				<img alt='' src='https://s2.wp.com/i/logo/wpcom-gray-white.png' class='avatar avatar-50' height='50' width='50' />				Darren Martyn			</a>
		</li>
										<form method="post" action="https://subscribe.wordpress.com" accept-charset="utf-8" style="display: none;">
																				<div>
										<input type="email" name="email" placeholder="Enter your email address" class="actnbr-email-field" aria-label="Enter your email address" />
										</div>
										<input type="hidden" name="action" value="subscribe" />
										<input type="hidden" name="blog_id" value="171792927" />
										<input type="hidden" name="source" value="https://darrenmartyn.ie/2021/11/29/analysis-of-the-lib__mdma-so-1-userland-rootkit/" />
										<input type="hidden" name="sub-type" value="actionbar-follow" />
										<input type="hidden" id="_wpnonce" name="_wpnonce" value="0a50f0ecc3" />										<div class="actnbr-button-wrap">
											<button type="submit" value="Sign me up">
												Sign me up											</button>
										</div>
									</form>
									<li class="actnbr-login-nudge">
										<div>
											Already have a WordPress.com account? <a href="https://wordpress.com/log-in?redirect_to=https%3A%2F%2Fr-login.wordpress.com%2Fremote-login.php%3Faction%3Dlink%26back%3Dhttps%253A%252F%252Fdarrenmartyn.ie%252F2021%252F11%252F29%252Fanalysis-of-the-lib__mdma-so-1-userland-rootkit%252F">Log in now.</a>										</div>
									</li>
								</ul>
															</div>
						</div>
					</li>
							<li class="actnbr-ellipsis actnbr-hidden">
				<svg class="gridicon gridicons-ellipsis" height="24" width="24" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><g><path d="M7 12c0 1.104-.896 2-2 2s-2-.896-2-2 .896-2 2-2 2 .896 2 2zm12-2c-1.104 0-2 .896-2 2s.896 2 2 2 2-.896 2-2-.896-2-2-2zm-7 0c-1.104 0-2 .896-2 2s.896 2 2 2 2-.896 2-2-.896-2-2-2z"/></g></svg>				<div class="actnbr-popover tip tip-top-left actnbr-more">
					<div class="tip-arrow"></div>
					<div class="tip-inner">
						<ul>
									<li class="actnbr-sitename">
			<a href="https://darrenmartyn.ie">
				<img alt='' src='https://s2.wp.com/i/logo/wpcom-gray-white.png' class='avatar avatar-50' height='50' width='50' />				Darren Martyn			</a>
		</li>
								<li class="actnbr-folded-customize">
								<a href="https://darrenmartynie.wordpress.com/wp-admin/customize.php?url=https%3A%2F%2Fdarrenmartynie.wordpress.com%2F2021%2F11%2F29%2Fanalysis-of-the-lib__mdma-so-1-userland-rootkit%2F">
									<svg class="gridicon gridicons-customize" height="20" width="20" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><g><path d="M2 6c0-1.505.78-3.08 2-4 0 .845.69 2 2 2 1.657 0 3 1.343 3 3 0 .386-.08.752-.212 1.09.74.594 1.476 1.19 2.19 1.81L8.9 11.98c-.62-.716-1.214-1.454-1.807-2.192C6.753 9.92 6.387 10 6 10c-2.21 0-4-1.79-4-4zm12.152 6.848l1.34-1.34c.607.304 1.283.492 2.008.492 2.485 0 4.5-2.015 4.5-4.5 0-.725-.188-1.4-.493-2.007L18 9l-2-2 3.507-3.507C18.9 3.188 18.225 3 17.5 3 15.015 3 13 5.015 13 7.5c0 .725.188 1.4.493 2.007L3 20l2 2 6.848-6.848c1.885 1.928 3.874 3.753 5.977 5.45l1.425 1.148 1.5-1.5-1.15-1.425c-1.695-2.103-3.52-4.092-5.448-5.977z"/></g></svg>									<span>Customise</span>
								</a>
							</li>
																<li class="actnbr-folded-follow">
												<a class="actnbr-action actnbr-actn-follow " href="">
			<svg class="gridicon gridicons-reader-follow" height="24" width="24" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><g><path d="M23 16v2h-3v3h-2v-3h-3v-2h3v-3h2v3h3zM20 2v9h-4v3h-3v4H4c-1.1 0-2-.9-2-2V2h18zM8 13v-1H4v1h4zm3-3H4v1h7v-1zm0-2H4v1h7V8zm7-4H4v2h14V4z"/></g></svg><span>Follow</span>
		</a>
		<a class="actnbr-action actnbr-actn-following  no-display" href="">
			<svg class="gridicon gridicons-reader-following" height="24" width="24" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><g><path d="M23 13.482L15.508 21 12 17.4l1.412-1.388 2.106 2.188 6.094-6.094L23 13.482zm-7.455 1.862L20 10.89V2H2v14c0 1.1.9 2 2 2h4.538l4.913-4.832 2.095 2.176zM8 13H4v-1h4v1zm3-2H4v-1h7v1zm0-2H4V8h7v1zm7-3H4V4h14v2z"/></g></svg><span>Following</span>
		</a>
										</li>
																	<li class="actnbr-signup"><a href="https://wordpress.com/start/">Sign up</a></li>
									<li class="actnbr-login"><a href="https://wordpress.com/log-in?redirect_to=https%3A%2F%2Fr-login.wordpress.com%2Fremote-login.php%3Faction%3Dlink%26back%3Dhttps%253A%252F%252Fdarrenmartyn.ie%252F2021%252F11%252F29%252Fanalysis-of-the-lib__mdma-so-1-userland-rootkit%252F">Log in</a></li>
																	<li class="actnbr-shortlink"><a href="https://wp.me/pbCPbF-7V">Copy shortlink</a></li>
																	<li class="flb-report"><a href="http://en.wordpress.com/abuse/">Report this content</a></li>
																	<li class="actnbr-reader">
										<a href="https://wordpress.com/read/blogs/171792927/posts/491">
											View post in Reader										</a>
									</li>
																	<li class="actnbr-subs">
										<a href="https://subscribe.wordpress.com/">Manage subscriptions</a>
									</li>
																		<li class="actnbr-fold"><a href="">Collapse this bar</a></li>
															</ul>
					</div>
				</div>
			</li>
		</ul>
	</div>
	
<script>
window.addEventListener( "load", function( event ) {
	var link = document.createElement( "link" );
	link.href = "https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.css?v=20210915";
	link.type = "text/css";
	link.rel = "stylesheet";
	document.head.appendChild( link );

	var script = document.createElement( "script" );
	script.src = "https://s0.wp.com/wp-content/mu-plugins/actionbar/actionbar.js?v=20211028";
	script.defer = true;
	document.body.appendChild( script );
} );
</script>

			<div id="jp-carousel-loading-overlay">
			<div id="jp-carousel-loading-wrapper">
				<span id="jp-carousel-library-loading">&nbsp;</span>
			</div>
		</div>
		<div class="jp-carousel-overlay" style="display: none;">

		<div class="jp-carousel-container">
			<!-- The Carousel Swiper -->
			<div
				class="jp-carousel-wrap swiper-container jp-carousel-swiper-container jp-carousel-transitions"
				itemscope
				itemtype="https://schema.org/ImageGallery">
				<div class="jp-carousel swiper-wrapper"></div>
				<div class="jp-swiper-button-prev swiper-button-prev">
					<svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg">
						<mask id="maskPrev" mask-type="alpha" maskUnits="userSpaceOnUse" x="8" y="6" width="9" height="12">
							<path d="M16.2072 16.59L11.6496 12L16.2072 7.41L14.8041 6L8.8335 12L14.8041 18L16.2072 16.59Z" fill="white"/>
						</mask>
						<g mask="url(#maskPrev)">
							<rect x="0.579102" width="23.8823" height="24" fill="#FFFFFF"/>
						</g>
					</svg>
				</div>
				<div class="jp-swiper-button-next swiper-button-next">
					<svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg">
						<mask id="maskNext" mask-type="alpha" maskUnits="userSpaceOnUse" x="8" y="6" width="8" height="12">
							<path d="M8.59814 16.59L13.1557 12L8.59814 7.41L10.0012 6L15.9718 12L10.0012 18L8.59814 16.59Z" fill="white"/>
						</mask>
						<g mask="url(#maskNext)">
							<rect x="0.34375" width="23.8822" height="24" fill="#FFFFFF"/>
						</g>
					</svg>
				</div>
			</div>
			<!-- The main close buton -->
			<div class="jp-carousel-close-hint">
				<svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg">
					<mask id="maskClose" mask-type="alpha" maskUnits="userSpaceOnUse" x="5" y="5" width="15" height="14">
						<path d="M19.3166 6.41L17.9135 5L12.3509 10.59L6.78834 5L5.38525 6.41L10.9478 12L5.38525 17.59L6.78834 19L12.3509 13.41L17.9135 19L19.3166 17.59L13.754 12L19.3166 6.41Z" fill="white"/>
					</mask>
					<g mask="url(#maskClose)">
						<rect x="0.409668" width="23.8823" height="24" fill="#FFFFFF"/>
					</g>
				</svg>
			</div>
			<!-- Image info, comments and meta -->
			<div class="jp-carousel-info">
				<div class="jp-carousel-info-footer">
					<div class="jp-carousel-pagination-container">
						<div class="jp-swiper-pagination swiper-pagination"></div>
						<div class="jp-carousel-pagination"></div>
					</div>
					<div class="jp-carousel-photo-title-container">
						<h2 class="jp-carousel-photo-caption"></h2>
					</div>
					<div class="jp-carousel-photo-icons-container">
						<a href="#" class="jp-carousel-icon-btn jp-carousel-icon-info" aria-label="Toggle photo metadata visibility">
							<span class="jp-carousel-icon">
								<svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg">
									<mask id="maskInfo" mask-type="alpha" maskUnits="userSpaceOnUse" x="2" y="2" width="21" height="20">
										<path fill-rule="evenodd" clip-rule="evenodd" d="M12.7537 2C7.26076 2 2.80273 6.48 2.80273 12C2.80273 17.52 7.26076 22 12.7537 22C18.2466 22 22.7046 17.52 22.7046 12C22.7046 6.48 18.2466 2 12.7537 2ZM11.7586 7V9H13.7488V7H11.7586ZM11.7586 11V17H13.7488V11H11.7586ZM4.79292 12C4.79292 16.41 8.36531 20 12.7537 20C17.142 20 20.7144 16.41 20.7144 12C20.7144 7.59 17.142 4 12.7537 4C8.36531 4 4.79292 7.59 4.79292 12Z" fill="white"/>
									</mask>
									<g mask="url(#maskInfo)">
										<rect x="0.8125" width="23.8823" height="24" fill="#FFFFFF"/>
									</g>
								</svg>
							</span>
						</a>
												<a href="#" class="jp-carousel-icon-btn jp-carousel-icon-comments" aria-label="Toggle photo comments visibility">
							<span class="jp-carousel-icon">
								<svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg">
									<mask id="maskComments" mask-type="alpha" maskUnits="userSpaceOnUse" x="2" y="2" width="21" height="20">
										<path fill-rule="evenodd" clip-rule="evenodd" d="M4.3271 2H20.2486C21.3432 2 22.2388 2.9 22.2388 4V16C22.2388 17.1 21.3432 18 20.2486 18H6.31729L2.33691 22V4C2.33691 2.9 3.2325 2 4.3271 2ZM6.31729 16H20.2486V4H4.3271V18L6.31729 16Z" fill="white"/>
									</mask>
									<g mask="url(#maskComments)">
										<rect x="0.34668" width="23.8823" height="24" fill="#FFFFFF"/>
									</g>
								</svg>

								<span class="jp-carousel-has-comments-indicator" aria-label="This image has comments."></span>
							</span>
						</a>
											</div>
				</div>
				<div class="jp-carousel-info-extra">
					<div class="jp-carousel-info-content-wrapper">
						<div class="jp-carousel-photo-title-container">
							<h2 class="jp-carousel-photo-title"></h2>
						</div>
						<div class="jp-carousel-comments-wrapper">
															<div id="jp-carousel-comments-loading">
									<span>Loading Comments...</span>
								</div>
								<div class="jp-carousel-comments"></div>
								<div id="jp-carousel-comment-form-container">
									<span id="jp-carousel-comment-form-spinner">&nbsp;</span>
									<div id="jp-carousel-comment-post-results"></div>
																														<form id="jp-carousel-comment-form">
												<label for="jp-carousel-comment-form-comment-field" class="screen-reader-text">Write a Comment...</label>
												<textarea
													name="comment"
													class="jp-carousel-comment-form-field jp-carousel-comment-form-textarea"
													id="jp-carousel-comment-form-comment-field"
													placeholder="Write a Comment..."
												></textarea>
												<div id="jp-carousel-comment-form-submit-and-info-wrapper">
													<div id="jp-carousel-comment-form-commenting-as">
																													<fieldset>
																<label for="jp-carousel-comment-form-email-field">Email (Required)</label>
																<input type="text" name="email" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-email-field" />
															</fieldset>
															<fieldset>
																<label for="jp-carousel-comment-form-author-field">Name (Required)</label>
																<input type="text" name="author" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-author-field" />
															</fieldset>
															<fieldset>
																<label for="jp-carousel-comment-form-url-field">Website</label>
																<input type="text" name="url" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-url-field" />
															</fieldset>
																											</div>
													<input
														type="submit"
														name="submit"
														class="jp-carousel-comment-form-button"
														id="jp-carousel-comment-form-button-submit"
														value="Post Comment" />
												</div>
											</form>
																											</div>
													</div>
						<div class="jp-carousel-image-meta">
							<div class="jp-carousel-title-and-caption">
								<div class="jp-carousel-photo-info">
									<h3 class="jp-carousel-caption" itemprop="caption description"></h3>
								</div>

								<div class="jp-carousel-photo-description"></div>
							</div>
							<ul class="jp-carousel-image-exif" style="display: none;"></ul>
							<a class="jp-carousel-image-download" target="_blank" style="display: none;">
								<svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg">
									<mask id="mask0" mask-type="alpha" maskUnits="userSpaceOnUse" x="3" y="3" width="19" height="18">
										<path fill-rule="evenodd" clip-rule="evenodd" d="M5.84615 5V19H19.7775V12H21.7677V19C21.7677 20.1 20.8721 21 19.7775 21H5.84615C4.74159 21 3.85596 20.1 3.85596 19V5C3.85596 3.9 4.74159 3 5.84615 3H12.8118V5H5.84615ZM14.802 5V3H21.7677V10H19.7775V6.41L9.99569 16.24L8.59261 14.83L18.3744 5H14.802Z" fill="white"/>
									</mask>
									<g mask="url(#mask0)">
										<rect x="0.870605" width="23.8823" height="24" fill="#FFFFFF"/>
									</g>
								</svg>
								<span class="jp-carousel-download-text"></span>
							</a>
							<div class="jp-carousel-image-map" style="display: none;"></div>
						</div>
					</div>
				</div>
			</div>
		</div>

		</div>
		
	<script type="text/javascript">
		window.WPCOM_sharing_counts = {"https:\/\/darrenmartyn.ie\/2021\/11\/29\/analysis-of-the-lib__mdma-so-1-userland-rootkit\/":491};
	</script>
				<link rel='stylesheet' id='all-css-0-2' href='https://s0.wp.com/_static/??/wp-content/mu-plugins/carousel/swiper-bundle.css,/wp-content/mu-plugins/carousel/jetpack-carousel.css?m=1630955947j&cssminify=yes' type='text/css' media='all' />
<script id='comment-like-js-extra'>
var comment_like_text = {"loading":"Loading...","swipeUrl":"https:\/\/s2.wp.com\/wp-content\/mu-plugins\/comment-likes\/js\/lib\/swipe.js?ver=20131008"};
</script>
<script id='coblocks-lightbox-js-extra'>
var coblocksLigthboxData = {"closeLabel":"Close Gallery","leftLabel":"Previous","rightLabel":"Next"};
</script>
<script id='jetpack-carousel-js-extra'>
var jetpackSwiperLibraryPath = {"url":"\/wp-content\/mu-plugins\/carousel\/swiper-bundle.js"};
var jetpackCarouselStrings = {"widths":[370,700,1000,1200,1400,2000],"is_logged_in":"","lang":"en","ajaxurl":"https:\/\/darrenmartyn.ie\/wp-admin\/admin-ajax.php","nonce":"3476208070","display_exif":"1","display_comments":"1","display_geo":"1","single_image_gallery":"1","single_image_gallery_media_file":"","background_color":"black","comment":"Comment","post_comment":"Post Comment","write_comment":"Write a Comment...","loading_comments":"Loading Comments...","download_original":"View full size <span class=\"photo-size\">{0}<span class=\"photo-size-times\">\u00d7<\/span>{1}<\/span>","no_comment_text":"Please be sure to submit some text with your comment.","no_comment_email":"Please provide an email address to comment.","no_comment_author":"Please provide your name to comment.","comment_post_error":"Sorry, but there was an error posting your comment. Please try again later.","comment_approved":"Your comment was approved.","comment_unapproved":"Your comment is in moderation.","camera":"Camera","aperture":"Aperture","shutter_speed":"Shutter Speed","focal_length":"Focal Length","copyright":"Copyright","comment_registration":"0","require_name_email":"1","login_url":"https:\/\/darrenmartynie.wordpress.com\/wp-login.php?redirect_to=https%3A%2F%2Fdarrenmartyn.ie%2F2021%2F11%2F29%2Fanalysis-of-the-lib__mdma-so-1-userland-rootkit%2F","blog_id":"171792927","meta_data":["camera","aperture","shutter_speed","focal_length","copyright"],"stats_query_args":"blog=171792927&v=wpcom&tz=0&user_id=0&subd=darrenmartynie","is_public":"1"};
</script>
<script id='sharing-js-js-extra'>
var sharing_js_options = {"lang":"en","counts":"1","is_stats_active":"1"};
</script>
<script crossorigin='anonymous' type='text/javascript' src='https://s1.wp.com/_static/??-eJyVkd1OwzAMhV+I1Oomse0C8Sz5Ma27xAmJs9K3J6iqQEWq4Crxcb5j6wTmpGxkQRaYCjh8kMX00U3lCX60QlXJ14G4gKc7FnivWHHU7Dzmg8c2htAktULTTtiD35Tx0d4LnLr+2vWqUEgewVGR1WNtN5NhFBN/bSsjhjYuVQMyN2FhYhRE/qJTpphJFtX2qP8iJVY7qjsuJursFOsHDVoo8kEA2gViZXSGoItgbjclWbftN4jY+urWdFqJwaDrGnSUqs6xFvQwoaTmpTbhD4yaU/uDXXnApVhEvXlNGcqoM/GwnQ16DS/98/l2OV9O19v0CS+U3Jw='></script>
<script type='text/javascript'>
var windowOpen;
			( function () {
				function matches( el, sel ) {
					return !! (
						el.matches && el.matches( sel ) ||
						el.msMatchesSelector && el.msMatchesSelector( sel )
					);
				}

				document.body.addEventListener( 'click', function ( event ) {
					if ( ! event.target ) {
						return;
					}

					var el;
					if ( matches( event.target, 'a.share-twitter' ) ) {
						el = event.target;
					} else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-twitter' ) ) {
						el = event.target.parentNode;
					}

					if ( el ) {
						event.preventDefault();

						// If there's another sharing window open, close it.
						if ( typeof windowOpen !== 'undefined' ) {
							windowOpen.close();
						}
						windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomtwitter', 'menubar=1,resizable=1,width=600,height=350' );
						return false;
					}
				} );
			} )();
var windowOpen;
			( function () {
				function matches( el, sel ) {
					return !! (
						el.matches && el.matches( sel ) ||
						el.msMatchesSelector && el.msMatchesSelector( sel )
					);
				}

				document.body.addEventListener( 'click', function ( event ) {
					if ( ! event.target ) {
						return;
					}

					var el;
					if ( matches( event.target, 'a.share-facebook' ) ) {
						el = event.target;
					} else if ( event.target.parentNode && matches( event.target.parentNode, 'a.share-facebook' ) ) {
						el = event.target.parentNode;
					}

					if ( el ) {
						event.preventDefault();

						// If there's another sharing window open, close it.
						if ( typeof windowOpen !== 'undefined' ) {
							windowOpen.close();
						}
						windowOpen = window.open( el.getAttribute( 'href' ), 'wpcomfacebook', 'menubar=1,resizable=1,width=600,height=400' );
						return false;
					}
				} );
			} )();
</script>
	<script>
	/(trident|msie)/i.test(navigator.userAgent)&&document.getElementById&&window.addEventListener&&window.addEventListener("hashchange",function(){var t,e=location.hash.substring(1);/^[A-z0-9_-]+$/.test(e)&&(t=document.getElementById(e))&&(/^(?:a|select|input|button|textarea)$/i.test(t.tagName)||(t.tabIndex=-1),t.focus())},!1);
	</script>
	<script type="text/javascript">
// <![CDATA[
(function() {
try{
  if ( window.external &&'msIsSiteMode' in window.external) {
    if (window.external.msIsSiteMode()) {
      var jl = document.createElement('script');
      jl.type='text/javascript';
      jl.async=true;
      jl.src='/wp-content/plugins/ie-sitemode/custom-jumplist.php';
      var s = document.getElementsByTagName('script')[0];
      s.parentNode.insertBefore(jl, s);
    }
  }
}catch(e){}
})();
// ]]>
</script>	<iframe src='https://widgets.wp.com/likes/master.html?ver=20211208#ver=20211208&amp;lang=en-gb&amp;lang_ver=1629196844&amp;origin=https://darrenmartyn.ie' scrolling='no' id='likes-master' name='likes-master' style='display:none;'></iframe>
	<div id='likes-other-gravatars'>
		<div class="likes-text">
			<span>%d</span> bloggers like this:		</div>
		<ul class="wpl-avatars sd-like-gravatars"></ul>
	</div>

		<script src="//stats.wp.com/w.js?63" defer></script> <script type="text/javascript">
_tkq = window._tkq || [];
_stq = window._stq || [];
_tkq.push(['storeContext', {'blog_id':'171792927','blog_tz':'0','user_lang':'en-gb','blog_lang':'en-gb','user_id':'0'}]);
_stq.push(['view', {'blog':'171792927','v':'wpcom','tz':'0','user_id':'0','post':'491','subd':'darrenmartynie'}]);
_stq.push(['extra', {'crypt':'UE40eW5QN0p8M2Y/RE1TaVhzUzFMbjdWNHpwZGhTayxPSUFCMGNrd29+Smw0TDhnZmRTK0hlRi9QSGh6bi9GXVhBJWIlZlR5U1JMLU8/MkNtblkvY1dzK3YrWW1PeUxPL0phL1JqSywrbkFFPXlsOExvd2x3PTh1WVZIL1RtaSZHOS5rM2guY3lxbU1heTJrP1BYdC9RTEVEVkxTdklST2UtWGkvOXZtZTYmbGJ2a1B6cS15ZGREY3oyYzRFXThITmZxbll2Kz9xdEJBK2ttLVpzPVJqczFuNi4xNlo1N3dDaVJrPX5nNTV1ak9oS2o5JixCZi5BbjImaHZQMW1yUU1hLGcrY05wbTZtT2lIM0clSHdXLU9Ua0lGfkIwaGY='}]);
_stq.push([ 'clickTrackerInit', '171792927', '491' ]);
	</script>
<noscript><img src="https://pixel.wp.com/b.gif?v=noscript" style="height:1px;width:1px;overflow:hidden;position:absolute;bottom:1px;" alt="" /></noscript>
<script>
if ( 'object' === typeof wpcom_mobile_user_agent_info ) {

	wpcom_mobile_user_agent_info.init();
	var mobileStatsQueryString = "";
	
	if( false !== wpcom_mobile_user_agent_info.matchedPlatformName )
		mobileStatsQueryString += "&x_" + 'mobile_platforms' + '=' + wpcom_mobile_user_agent_info.matchedPlatformName;
	
	if( false !== wpcom_mobile_user_agent_info.matchedUserAgentName )
		mobileStatsQueryString += "&x_" + 'mobile_devices' + '=' + wpcom_mobile_user_agent_info.matchedUserAgentName;
	
	if( wpcom_mobile_user_agent_info.isIPad() )
		mobileStatsQueryString += "&x_" + 'ipad_views' + '=' + 'views';

	if( "" != mobileStatsQueryString ) {
		new Image().src = document.location.protocol + '//pixel.wp.com/g.gif?v=wpcom-no-pv' + mobileStatsQueryString + '&baba=' + Math.random();
	}
	
}
</script>
</body>
</html>
<!--
	generated in 0.264 seconds
	116494 bytes batcached for 300 seconds
-->
